Elastic Windows Event Explorer
Publisher - Microsoft-Windows-Audit
Event IDs
1001
1002
2001
2002
2003
2004